178.20.212.20

(mod_security) mod_security (id:210350) triggered by 178.20.212.20 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 23:36:52.036834 2026] [security2:error] [pid 24707:tid 24707] [client 178.20.212.20:56683] M ... show more (mod_security) mod_security (id:210350) triggered by 178.20.212.20 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 23:36:52.036834 2026] [security2:error] [pid 24707:tid 24707] [client 178.20.212.20:56683] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.ctrussell.us|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.ctrussell.us"] [uri "/3e8bddb381ab8aff862566bd000abc73/f0b7e2098e54263a862564520075cb1e_7b4ad6db.html"] [unique_id "avflZEcnVrvELapWKbofBgAAABU"] show less

HTTP application-layer DoS / botnet traffic from 178.20.212.20: repeated high-cost dynamic page and feed requests (profile/tag views, forums, tracker, RSS) at abusive rates via completed TCP/HTTPS. Likely compromised end-user host.

Web attack/malicious scanning detected

Web attack/Malicious activity detected

Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -49.834 (Bad < -10 / Very Bad < -20 / Extreme < -35) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.3189.1

Detected wp_admin attack from WP-host.

LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 178.20.212.20 (SC/Seychelles/-): 1 in the last 3600 secs

Fail2Ban banned 178.20.212.20 for security violations in jail wp-armour. Log: 2026/05/19 06:44:03 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 178.20.212.20 | Target: wplogin" , client: 178.20.212.20, server: [REDACTED], request: ... show more Fail2Ban banned 178.20.212.20 for security violations in jail wp-armour. Log: 2026/05/19 06:44:03 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 178.20.212.20 | Target: wplogin" , client: 178.20.212.20, server: [REDACTED], request: "POST /wp-login.php HTTP/1.1", upstream: [REDACTED], host: [REDACTED], referrer: "http://comerciogallego.es/wp-login.php" ... show less

block ruleset CC531825F9395F9A07FB06C1247C46770A2690F8

(mod_security) mod_security (id:210730) triggered by 178.20.212.20 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 16 19:32:13.574890 2026] [security2:error] [pid 5935:tid 5935] [client 178.20.212.20:42557] Mod ... show more (mod_security) mod_security (id:210730) triggered by 178.20.212.20 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 16 19:32:13.574890 2026] [security2:error] [pid 5935:tid 5935] [client 178.20.212.20:42557] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||vitalitywebb.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "vitalitywebb.com"] [uri "/backstore/Golden-Technologies/pics/Golden Technologies 2009 Marketing CD/Lift Chairs/Thumbs.db"] [unique_id "agj-fcnuv7e_9JGH0J3OWQAAABk"], referer: https://vitalitywebb.com/backstore/Golden-Technologies/pics/Golden%20Technologies%202009%20Marketing%20CD/Lift%20Chairs/ show less

This IP was detected by CrowdSec triggering crowdsecurity/http-probing. crowdsecurity/http-probing

(mod_security) mod_security (id:218580) triggered by 178.20.212.20 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 13 16:39:21.495711 2026] [security2:error] [pid 4022:tid 4022] [client 178.20.212.20:62983] Mod ... show more (mod_security) mod_security (id:218580) triggered by 178.20.212.20 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 13 16:39:21.495711 2026] [security2:error] [pid 4022:tid 4022] [client 178.20.212.20:62983] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:\\\\/\\\\*[!+](?:[\\\\w\\\\s=_\\\\-()]+)?\\\\*\\\\/)" at ARGS:mobile. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/22_SQL_SQLi.conf"] [line "76"] [id "218580"] [rev "1"] [msg "COMODO WAF: MySQL in-line comment detected.||www.genesis-castle.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "SQLi"] [hostname "www.genesis-castle.com"] [uri "/gallery/picture.php"] [unique_id "agTheZ019SK1vPp7nkc-dgAAAAA"] show less

block ruleset CC531825F9395F9A07FB06C1247C46770A2690F8

LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 178.20.212.20 (SC/Seychelles/-): 1 in the last 3600 secs